Technical Tip: FortiOS IPv6 resource list
Description
This article provides a list of links to knowledge resources regarding IPv6 support on the FortiGate. These links are organized into several categories, including:
- Basic guidance and documentation.
- Advanced configuration.
- Troubleshooting IPv6 and known behaviors.
Scope
FortiGate, IPv6.
Solution
For an initial primer on IPv6 and its benefits compared to IPv4, check out the following section of the FortiOS Administration Guide: IPv6 overview.
| Basic Guidance and Documentation | |
| Title and Links | Description |
| IPv6 quick start | Contains instructions for initial setup of IPv6 on the FortiGate, including configuring an IPv6 address on an interface, creating initial default routes for Internet access and creating IPv6 Firewall Policies. |
| NAT66, NAT46, NAT64, and DNS64 | Discusses how to configure various forms of IPv4/IPv6 address translation for network compatibility purposes, such as NAT66, NAT46, and NAT64 with DNS64. |
| IPv6 tunneling | Discusses IPv6 tunnelling support for FortiOS, including IPsec and GRE. |
| Dynamic routing in IPv6 | Discusses support for IPv6-based dynamic routing protocols, including OSPFv3 and multi-protocol BGP. |
| IPv6 configuration examples | Provides example configurations and step-by-step setup guides for several common IPv6 deployment scenarios. |
| Technical Tip: IPv6 support | Provides an overview of the various features/sections of the FortiGate that support IPv6. |
| Technical Tip: How to access FortiGate GUI using IPv6 address in a web browser | Provides guidance on how to access the FortiGate admin web GUI using IPv6 addresses, as the process has some unique differences compared to using IPv4 addresses in a web browser. |
| Technical Tip: How to setup the FortiGate to assign IPv6 addresses | Provides an overview for configuring the FortiGate to dynamically serve IPv6 addresses to clients on the network (via SLAAC, DHCPv6, etc.), as well as how to do so and what key settings must be configured for each method. |
| Technical Tip: Configure multiple RDNSS IPv6 addresses on the FortiGate | Explains how to configure the FortiGate to provide DNS server addresses to clients using Recursive DNS Server (RDNSS) rather than needing DHCPv6. |
| Technical Tip: How to configure a secondary IPv6 address on a FortiGate interface | Explains how to configure additional/secondary IPv6 addresses on FortiGate network interfaces. |
| Technical Tip: FQDN support for IPv6 Address Object | Discusses the initial introduction of FQDN Address object support for IPv6 in FortiOS. |
| Technical Tip: SD-WAN support added for IPv6 in FortiOS v6.0 and later | Discusses the initial introduction of IPv6 support for SD-WAN on the FortiGate. |
| Technical Tip: IPv6 Support for Fortinet Single Sign-On (FSSO) | Discusses the requirements for enabling IPv6 support for FSSO (both for IPv6 communication between the Collector Agent and the FortiGate, as well as the sharing of IPv6 user login information). |
| Technical Tip: Disabling IPv6 on the FortiGate using the CLI | Provides guidance on removing/disabling IPv6 access on the FortiGate. |
| Advanced Configuration | |
| Title and Links | Description |
| Technical Tip: How to add static ARP entry in IPv4 and Neighbor Cache in IPv6 | Describes how to add static IP/MAC address mappings for both IPv4 (via ARP) and IPv6 (via Neighbor Discovery). |
| Technical Tip: IPv6-neighbor-cache for neighbour discovery feature | Provides a deeper dive into IPv6 neighbor discovery functionality on the FortiGate. |
| Technical Tip: IPv6 Manual Configuration of a Link-Local Address | Explains how to manually configure an IPv6 link-local address on a FortiGate interface (useful for making the link-local address memorable and more easily associated with the FortiGate). |
| Technical Tip: Configuring IPv6 on an inter-VDOM link | Describes how to configure inter-VDOM links with IPv6 addresses. |
| Technical Tip: Configure FortiGate as a DHCP Server for IPv4 and IPv6 | Explains how to configure a FortiGate interface to provide dual-stack DHCP service to the network (i.e., both IPv4 and IPv6 dynamic addressing). |
| Technical Tip: SAML Authentication for IPv6 Outbound Firewall Policy with Azure as IdP | Describes how to configure IPv6-based SAML with Microsoft Azure Entra as the IdP, as well as how to apply this to IPv6 forward policies and proxy poicies. |
| Explains how to configure an IPsec tunnel across an IPv6 underlay that can carry IPv4 traffic to/from a remote site. | |
| Technical Tip: How to configure dial-up IPsec remote access with Dual Stack IPv4 and IPv6 configuration | Describes how to configure a remote access IPsec tunnel that supports both IPv4 and IPv6 traffic flowing through it. |
| Technical Tip: PPPoE-interface configuration for IPv4 and IPv6 | Provides guidance for configuring PPPoE on the FortiGate for both IPv4 and IPv6 WAN connections. |
| Technical Tip: Creating a Local-In policy (IPv4 and IPv6) on GUI | Explains how to configure Local-In Policies for both IPv4 and IPv6 in the FortiOS GUI. |
| Technical Tip: ECMP, Load balancing algorithms for IPv4 and IPv6 | Discusses how load-balancing works for equal-cost multipath (ECMP) routing for both IPv4 and IPv6. |
| Technical Tip: FortiGate VRF support for IPv6 (FortiOS 7.0.1 and later) | Discusses the introduction of VRF support for IPv6 in FortiOS 7.0.1 and later. |
| Technical Tip: RIPnG (RIP IPv6) configuration example | Explains how to configure IPv6-based RIPng on the FortiGate, as well as how to verify and troubleshoot. |
| Technical Tip: OSPFv3 (OSPF for IPv6) configuration example | Explains how to configure, verify, and troubleshoot OSPFv3 for IPv6 dynamic routing. |
| Technical Tip: BGP – IPv6 prefixes over IPv4 peering | Discusses how to configure multi-protocol BGP to advertise IPv6 prefixes over an IPv4-only peering. |
| Technical Tip: IPv6 Default Route Filtering and Preferred IPv6 Path Selection using BGP | Provides an example for how to configure the FortiGate to filter out IPv6 prefixes received via BGP, as well as how to apply different preferences for prefixes received from multiple ISP peers. |
| Troubleshooting IPv6 and Known Behaviors | |
| Title and Links | Description |
| Technical Tip: How to use debug flow and sniffer to capture IPv6 traffic | Explains how to use the debug flow and packet sniffer commands to capture and troubleshoot IPv6 traffic flow issues. |
| Technical Tip: How to verify IPv6 link-local address (LLA) connectivity from the FortiGate to a local host | Provides basic instructions for testing basic IPv6 link-local network connectivity between the FortiGate and a host on the network. |
| Technical Tip: Unable to reach IPv6 gateway that is a Subnet-Router Anycast Address | Discusses an expected behavior that can occur where setting the IPv6 subnet-router anycast address on a network interface directly can result in that interface not being reachable (and workarounds available). |
| Technical Tip: IPv6 FortiGuard connections and Initial Troubleshooting steps | Discusses initial steps for troubleshooting FortiGate-FortiGuard connectivity over IPv6. |
| Troubleshooting Tip: NAT64 and DNS64 is not working properly | Describes a known issue that can occur after configuring NAT64 and DNS64 where IPv4 reply traffic is not translated and routed back to the IPv6 client. |
| Troubleshooting Tip: SSL VPN fails at 98% | Describes a possible cause for the FortiGate SSL VPN getting stuck at 98% during connection setup due to IPv6. |
| Technical Tip: BGP IPv6 routes show IPv6 link-local address as next-hop rather than global unicast address (Expected Behavior) | Describes an expected behavior where IPv6 BGP routes will show a link-local address as the next-hop gateway, rather than an IPv6 unicast address. |
| Technical Tip: FortiGate BGP flapping due to IPv6 advertisement | Describes a scenario where IPv6 prefix advertisements over BGP can cause IPv4 peerings to flap, as well as how to workaround the issue. |
| Technical Tip: Proxy-based TLS deep-inspection of IPv6 traffic does not support the inspect-all function (Legacy, FortiOS 5.6/6.0 and earlier) | Discusses historical limitations with IPv6 and proxy-based TLS deep inspection, particularly when the 'inspect all ports' option is used. |